A module friendly name in the DNN platform can embed script code that executes when the module deletion confirmation modal is displayed. This allows an attacker who can set or modify the friendly name to store malicious JavaScript that runs in the context of the site’s users, resulting in confirmation‑modal based defacement, data exfiltration, or session hijacking. The vulnerability falls under CWE‑79 and is classified as a moderate‑to‑high severity issue.

The affected product is Dnn.Platform by dnnsoftware. Versions starting with 9.0.0 and continuing through just before 9.13.10, as well as all releases below 10.2.0, contain the flaw. The fix is included in Dnn.Platform 9.13.10 and later, and in 10.2.0 and later.

The CVSS score of 7.7 indicates a moderate‑to‑high impact, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. A likely attack vector involves an authenticated privileged user who can create or edit a module and set its friendly name, thereby injecting payloads that remain stored and render during future deletion interactions with the confirmation modal.